From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 12 Jul 2010 18:34:53 +0000 (+0200)
Subject: execute: close inherited fds earlier
X-Git-Tag: v3~31
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc9b2a84dcf70bdd3100cbcb84f2858dd5303d76;p=systemd

execute: close inherited fds earlier
---

diff --git a/src/execute.c b/src/execute.c
index 6363719c..5483b694 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -968,6 +968,14 @@ int exec_spawn(ExecCommand *command,
                         goto fail;
                 }
 
+                /* Close sockets very early to make sure we don' block
+                 * init reexecution because it cannot bind its sockets
+                 * or so */
+                if (close_all_fds(fds, n_fds) < 0) {
+                        r = EXIT_FDS;
+                        goto fail;
+                }
+
                 if (!context->same_pgrp)
                         if (setsid() < 0) {
                                 r = EXIT_SETSID;
@@ -1111,16 +1119,6 @@ int exec_spawn(ExecCommand *command,
 
 #ifdef HAVE_PAM
                 if (context->pam_name && username) {
-                        /* Make sure no fds leak into the PAM
-                         * supervisor process. We will call this later
-                         * on again to make sure that any fds leaked
-                         * by the PAM modules get closed before our
-                         * exec(). */
-                        if (close_all_fds(fds, n_fds) < 0) {
-                                r = EXIT_FDS;
-                                goto fail;
-                        }
-
                         if (setup_pam(context->pam_name, username, context->tty_path, &pam_env, fds, n_fds) < 0) {
                                 r = EXIT_PAM;
                                 goto fail;
@@ -1180,6 +1178,8 @@ int exec_spawn(ExecCommand *command,
                         free(d);
                 }
 
+                /* We repeat the fd closing here, to make sure that
+                 * nothing is leaked from the PAM modules */
                 if (close_all_fds(fds, n_fds) < 0 ||
                     shift_fds(fds, n_fds) < 0 ||
                     flags_fds(fds, n_fds, context->non_blocking) < 0) {